# Public web root.
# IMPORTANT: the parent hms/.htaccess denies all access to the project root.
# Apache 2.4 applies .htaccess rules down the whole directory tree, so this
# file must explicitly re-grant access or every page under /public would
# also return 403 Forbidden.
<IfModule mod_authz_core.c>
    Require all granted
</IfModule>
<IfModule !mod_authz_core.c>
    Order allow,deny
    Allow from all
</IfModule>

Options -Indexes
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>
